TI-2026-62115 CVE-2026-91985 · GHSA-37rx-7pj5-p885 · GHSA-qfwc-vx6f-3g6g Priority HIGH 77
Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00432 · Published 2026-09-15 · Fixed in 2.6.0 CWE-200
TI-2026-62114 CVE-2026-91984 · GHSA-ccgq-fx7h-2v4c · GHSA-w39f-h553-h2mx Priority LOW 24
Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00264 · Published 2026-09-15 · Fixed in 2.6.0 CWE-639
TI-2026-62113 CVE-2026-91983 · GHSA-9rg3-v78m-26q8 · GHSA-phph-c358-5mwm Priority MEDIUM 57
Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00305 · Published 2026-09-15 · Fixed in 2.6.0 CWE-863
TI-2026-62112 CVE-2026-91982 · GHSA-88f6-4rjv-x774 · GHSA-jmr8-r558-3jhx Priority MEDIUM 57
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-09-15 · Fixed in 2.6.0 CWE-522
TI-2026-62111 CVE-2026-91981 · GHSA-vcgv-7rvm-m3vp · GHSA-vfxw-3x8p-2vjr Priority MEDIUM 57
Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00306 · Published 2026-09-15 · Fixed in 2.6.0 CWE-200
TI-2026-62110 CVE-2026-91980 · GHSA-2922-qgfj-pr7v · GHSA-39p5-2wrr-xh29 Priority MEDIUM 57
vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00306 · Published 2026-09-15 · Fixed in 2.6.0 CWE-200
TI-2026-62109 CVE-2026-91979 · GHSA-p4h8-xg7f-xqrc · GHSA-w7jp-mf2v-8342 Priority LOW 32
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-09-15 · Fixed in 2.6.0 CWE-400
TI-2026-62108 CVE-2026-91973 · GHSA-m469-88xx-8rx2 · GHSA-p2vv-wrh8-x466 Priority HIGH 77
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00672 · Published 2026-09-15 · Fixed in 2.6.0 CWE-307
TI-2026-62107 CVE-2026-91972 · GHSA-6rvj-qwjf-3m4q · GHSA-m4vj-wr5q-cmvr Priority HIGH 77
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00633 · Published 2026-09-15 · Fixed in 2.6.0 CWE-307
TI-2026-62106 CVE-2026-91971 · GHSA-4vh2-39rq-rq8j · GHSA-69rj-q3v9-vffp Priority MEDIUM 64
Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-09-15 · Fixed in 2.6.0 CWE-400
TI-2026-62105 CVE-2026-91970 · GHSA-c2g7-39fr-cp8q · GHSA-wq92-8x3r-fm38 Priority MEDIUM 64
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-09-15 · Fixed in 2.6.0 CWE-770
TI-2026-62104 CVE-2026-91969 · GHSA-55p4-8j34-jv53 · GHSA-pqf9-h8g4-8gmh Priority LOW 31
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-09-15 · Fixed in 2.6.0 CWE-400
TI-2026-62103 CVE-2026-91968 · GHSA-jfw3-2gcf-23r5 · GHSA-xxc3-xpmc-vmvr Priority MEDIUM 64
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-09-15 · Fixed in 2.6.0 CWE-674
THREATIST.IORead the docs